2 files changed, 130 insertions, 0 deletions
diff --git a/routes/auth.js b/routes/auth.js
index e69de29..d6949d4 100644
--- a/routes/auth.js
+++ b/routes/auth.js
@@ -0,0 +1,76 @@
+const express = require('express');
+const bcrypt = require('bcryptjs');
+const db = require('../db');
+const requireAuth = require('../middleware/auth');
+
+const router = express.Router();
+
+/* register */
+router.post('/register', async (req, res) =>
+{
+   const { username, password } = req.body;
+   if (!username || !password)
+   {
+      return res.status(400).json({ error: 'Username and password required' });
+   }
+   try
+   {
+      const existing = db.prepare('SELECT id FROM users WHERE username = ?').get(username);
+      if (existing)
+      {
+         return res.status(409).json({ error: 'Username already taken' });
+      }
+      const hashed = bcrypt.hashSync(password, 10);
+      const result = db.prepare('INSERT INTO users (username, password) VALUES (?, ?)').run(username, hashed);
+      req.session.userId = result.lastInsertRowid;
+      res.status(201).json({ id: result.lastInsertRowid, username });
+   } catch (err)
+   {
+      res.status(500).json({ error: 'Registration failed' });
+   }
+});
+
+/* login. */
+router.post('/login', async (req, res) =>
+{
+   const { username, password } = req.body;
+   if (!username || !password)
+   {
+      return res.status(400).json({ error: 'Username and password required' });
+   }
+   try
+   {
+      const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);
+      if (!user || !bcrypt.compareSync(password, user.password))
+      {
+         return res.status(401).json({ error: 'Invalid username or password' });
+      }
+      req.session.userId = user.id;
+      res.json({ id: user.id, username: user.username });
+   } catch (err)
+   {
+      res.status(500).json({ error: 'Login failed' });
+   }
+});
+
+/* logout */
+router.post('/logout', (req, res) =>
+{
+   req.session.destroy(() =>
+   {
+      res.clearCookie('connect.sid');
+      res.json({ message: 'Logged out' });
+   });
+});
+
+/* check session */
+router.get('/check', (req, res) =>
+{
+   if (req.session.userId)
+   {
+      return res.json({ loggedIn: true });
+   }
+   res.status(401).json({ loggedIn: false });
+});
+
+module.exports = router;
diff --git a/routes/tasks.js b/routes/tasks.js
index e69de29..99b1748 100644
--- a/routes/tasks.js
+++ b/routes/tasks.js
@@ -0,0 +1,54 @@
+const express = require('express');
+const db = require('../db');
+const auth = require('../middleware/auth');
+const router = express.Router();
+
+/* all routes require login. */
+router.use(auth);
+
+/* create. */
+router.post('/', (req, res) =>
+{
+   const { title, description } = req.body;
+   if (!title) return res.status(400).json({ error: 'Title required' });
+   const result = db.prepare(
+      'INSERT INTO tasks (user_id, title, description) VALUES (?, ?, ?)'
+   ).run(req.session.userId, title, description || '');
+   res.json({ id: result.lastInsertRowid, title, description: description || '', done: 0 });
+});
+
+/* read all. */
+router.get('/', (req, res) =>
+{
+   const rows = db.prepare('SELECT * FROM tasks WHERE user_id = ?').all(req.session.userId);
+   res.json(rows);
+});
+
+/* read on. */
+router.get('/:id', (req, res) =>
+{
+   const row = db.prepare('SELECT * FROM tasks WHERE id = ? AND user_id = ?').get(req.params.id, req.session.userId);
+   if (!row) return res.status(404).json({ error: 'Task not found' });
+   res.json(row);
+});
+
+/* update. */
+router.put('/:id', (req, res) =>
+{
+   const { title, description, done } = req.body;
+   const result = db.prepare(
+      'UPDATE tasks SET title = COALESCE(?, title), description = COALESCE(?, description), done = COALESCE(?, done) WHERE id = ? AND user_id = ?'
+   ).run(title, description, done, req.params.id, req.session.userId);
+   if (result.changes === 0) return res.status(404).json({ error: 'Task not found' });
+   res.json({ id: Number(req.params.id), title, description, done });
+});
+
+/* delete. */
+router.delete('/:id', (req, res) =>
+{
+   const result = db.prepare('DELETE FROM tasks WHERE id = ? AND user_id = ?').run(req.params.id, req.session.userId);
+   if (result.changes === 0) return res.status(404).json({ error: 'Task not found' });
+   res.json({ message: 'Deleted' });
+});
+
+module.exports = router;